Application Removed Via Wmic.EXE — Detection Rule

Detects the removal or uninstallation of an application via "Wmic.EXE".

Read the full analysis on IntelFusions